I’ve seen a few instances on r/Coinbase lately where people are getting calls from Coinbase Support and the caller is able to spoof their support email and generate ticket numbers. The implication is that it’s a rogue employee (or employees).